A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and
    segmentation fault) via a crafted diff file. (CVE-2014-9637)

  - Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3
    allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot
    dot) in a diff file name. (CVE-2015-1395)

  - A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to
    arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix
    for CVE-2015-1196. (CVE-2015-1396)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2651-1 advisory.

    Jakub Wilk discovered that GNU patch did not correctly handle file paths in patch files. An attacker could     specially craft a patch file that could overwrite arbitrary files with the privileges of the user invoking     the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2010-4651)

    Lszl Bszrmnyi discovered that GNU patch did not correctly handle some patch files. An attacker     could specially craft a patch file that could cause a denial of service. (CVE-2014-9637)

    Jakub Wilk discovered that GNU patch did not correctly handle symbolic links in git style patch files. An     attacker could specially craft a patch file that could overwrite arbitrary files with the privileges of     the user invoking the program. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1196)

    Jakub Wilk discovered that GNU patch did not correctly handle file renames in git style patch files. An     attacker could specially craft a patch file that could overwrite arbitrary files with the privileges of     the user invoking the program. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1395)

    Jakub Wilk discovered the fix for CVE-2015-1196 was incomplete for GNU patch. An attacker could specially     craft a patch file that could overwrite arbitrary files with the privileges of the user invoking the     program. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1396)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The GNU patch utility was updated to 2.7.5 to fix three security issues and one non-security bug.

The following vulnerabilities were fixed :

  - CVE-2015-1196: directory traversal flaw when handling     git-style patches. This could allow an attacker to     overwrite arbitrary files by tricking the user into     applying a specially crafted patch. (bsc#913678)

  - CVE-2015-1395: directory traversal flaw when handling     patches which rename files. This could allow an attacker     to overwrite arbitrary files by tricking the user into     applying a specially crafted patch. (bsc#915328)

  - CVE-2015-1396: directory traversal flaw via symbolic     links. This could allow an attacker to overwrite     arbitrary files by tricking the user into applying a by     applying a specially crafted patch. (bsc#915329)

The following bug was fixed :

  - bsc#904519: Function names in hunks (from diff -p) are     now preserved in reject files.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401165	Alpine: multiple patch packages: security update to 2.7.4-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401165	Alpine: multiple patch packages: security update to 2.7.4-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
84339	Ubuntu 14.04 LTS : GNU patch vulnerabilities (USN-2651-1)	Nessus	Ubuntu Local Security Checks	high
84083	SUSE SLED12 / SLES12 Security Update : patch (SUSE-SU-2015:1019-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-1396

high

Tenable Plugins

high

high

high

high